Identity security in focus 2026.
This year, threat actors abuse legitimate credentials, trusted sessions, and familiar workflows. See what advances in GenAI and email compromise tell us about how, when, and why attacks happen in the year of silent intrusion.
The findings at a glance
Eye Security’s The State of BEC 2026 is based on 343 incidents investigated between January 1 and December 31, 2025, across midmarket organisations in the Benelux and Germany, representing 2,064 hours of incident response effort. Business Email Compromise (BEC) accounted for 81% of all cases, making it the dominant form of cyber intrusion observed.
Geographically, activity was concentrated in the Netherlands (66%), reflecting the dominant customer base, followed by Belgium (21%) and Germany (11%). Across all regions in the dataset, BEC consistently emerged as the primary incident type where MDR was present, indicating that visibility drives observed incidence rates.
The data reveals a structural gap between organisations with and without continuous monitoring. In MDR-enabled environments, median dwell time for BEC was 19 minutes. In contrast, in non-monitored environments, threat actors remained undetected for a median of 18 days. This disparity extends to response timelines, directly affecting the ability to contain financial and operational impact.
BEC is overwhelmingly an identity-driven threat. Over 99% of incidents occurred in Microsoft 365 environments, reflecting the prevalence of Microsoft 365 within the analysed environments. Multi-factor authentication (MFA) was bypassed in 79% of cases, most commonly through session hijacking techniques such as adversary-in-the-middle. Phishing via link remains the dominant entry vector, increasingly reinforced by generative AI.
Identity has become the primary attack surface, and detection speed is the defining variable in limiting impact. Preventive controls alone are insufficient. Effective defence depends on continuous visibility across environments, rapid investigation, and the ability to respond within minutes.
.png?width=300&name=Jan%20de%20rijk%20(1).png)
Discover why companies choose Eye Security.
Protect yourself against digital threats with Europe's leading Open XDR solution. Try a demo to see how Eye Security compares to your existing solution.
- Protect your business 24/7
- Prevent ransomware & data breaches
- Respond to attacks within minutes
- Mitigate financial losses with cyber insurance, advised by brokers
Trusted by European companies:
